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RECEIVED 

IN THE CLAIMS JUN 0 5 2008 

Please Amend the Claims as Follows: 

1. (currently amended) A method for classifying a message, comprising: 

extracting a plurality of reference points from a body of rh^ message p*rn ™.fo»»n^ 

point being information used to contact a referenced entity ; 
classifying each of the plurality of reference points based on a source agsodatgd wjfl 

each reference point: and 
dotocting that determinin g whether the message is a phioh fraudulent message 

appearing to be from a legitimate smirrp ina** on the classified reference point s; and 
processing the message based on the determination o f whether the- messag e is a ph^K 

fraudulent message appearing to be from a leg itimate so^r^ 

2. (currently amended) A The method feg ni-.rniJy™^ - m^n ^r n n r ec ited in Claim of claim 1, 
wherein classifying the plurality of reference points including includes looking up the plurality 
of reference points in a database. 

3. (currently amended) A The method for olaooifying a message aa recited in Claim of claim 1, 
wherein detecting that the message is a fte&k fraudulent message appearing to be from a 
legitimate source includes determining that the message includes divergent reference points. 

4. (currently amended) A The method for claopifying a moooago aa recited in Cla feft of claim l r 
wherein detecting that the message is a phish fraudulent message a ppearing to be from a 
legitimate source includes determining that the plurality of reference points includes a first 
reference; point to a first source and a second reference point to a second source. 
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5. (currently amended) A The method for classifying a message ao recited in Claim of claim 1, 
wherein detecting that the message is a phish fraudulent message appearing to be from a 
legitimate sour( ^ includes determining that the plurality of reference points includes a first 
reference point to a legitimate source and a second reference point to a questionable search. 

6. (currently amended) A Xhg method for cloooifyinfi a message ao recited in Claim of claim 1 . 
wherein detecting that the message is a phisfe fraudulent message a ppearing to be from a 
legitimate source includes determining that the plurality of reference points includes a first 
reference point to a first source and a second reference point to a second source, and the second 
reference point is intended to appear as a reference to the first source. 

7. (currently amended) A The method for classifying a mcooago as recited in Claim ofclaim 1, 
further comprising computing a thumbprint of the message and storing the thumbprint to a 
database. 

8. (currently amended) A The method for elaogifying a mcooago as recited in Claim ofclaim 1, 
further comprising computing a thumbprint of the message and storing the thumbprint to a 
database; wherein the database is shared. 

9. (currently amended) A The method for olaooifying a mcsaago ao recited in Claim of claim 1, 
further comprising identifying a plurality of fraud indicators and applying a statistical analysis 
on the plurality of fraud indicators. 

10. (currently amended) A Thg method for classifying a message nr r recited in Ch ii m of rlai^ 1, 
further comprising quarantining the message. 

11. (currently amended) A Th& method for classifying a moooage ao recited in Claim ofclaim 1, 
further Comprising deleting the message. 

3 
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12. (currently amended) A Hie method for claooifying a mcooago an recited in Point of claim 1, 
further comprising providing an alert to a recipient of the message. 

13. (currently amended) A The method for claooifying a moooage ao united in Claim of claim 1 . 
further comprising providing an alert to a recipient indicating that the message is a p hijh 
fraudulent message appea ring to be from a legitimate sourr ^ 

14. (currently amended) A The method for olaooifying a mcoaagc as rocitod in Claim ofclajm 1, 
further comprising providing an explanation of the phish fraudulent messag e appearing^ 
from a legitimate souncp tn a npHpiVnt 

15. (currently amended) A method for classifying a message, comprising: 

identifying a plurality of fraud indicators in the message; 
applying a statistical analysis On the plurality of fraud indicators; aad 
determining whether the message is a fraudulent message based on the analysis- and 
processing the message based on the determination o f whether th e message is a . 
fraudulent message. 

16. (currently amended) A The method for classifying a message ao recited in Cla im ojclajm 
15, wherein identifying the plurality of fraud indicators includes identifying a raw Internet 
protocol (IP) address. 

17. (currently amended) A The method for claooifying a mcooagc ao recited in Claim of claim 
15, wherein identifying the plurality of fraud indicators includes identifying non-standard 
encoding in the message* 

18. (currently amended) A The method for elaroifying a message ao recited in Cl u lm ©/.claim 
15, wherein identifying the plurality of fraud indicators includes identifying a link with an 
embedded user name. 
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19. (currently amended) A The method for classifying a message as recited in Claim of claim 15, 
wherein identifying the plurality of fraud indicators includes identifying a misleading link. 

20. (currently amended) A The method for classifying a message ao recited in Cla i m of r^im 
15, wherein identifying the plurality of fraud indicators includes identifying a mismatched link 
name. 

21. (currently amended) A Thg method for classifying a message ao recited in Claim of claim 
15, wherein identifying the plurality of fraud indicators includes identifying a form in the 
message. 

22. (currently amended) A Jhg method for classifying a message as recited in Claim crfclagQ 
15, wherein identifying the plurality of fraud indicators includes identifying a form tin the 
message that requests special information. 

23. (currently amended) A The method for classifying a message as recited in Claim of claim 
15, wherein identifying the plurality of fraud indicators includes identifying suspect content in 
the message. 

24. (currently amended) A The method for classifying a message as recited in ClaL u i of claim 
15, wherein applying a statistical analysis on the plurality of fraud indicators includes obtaining 
a score based on the fraud indicators. 
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25. (cancelled) 

26. (currently amended) A computer readable storage medium having embod ied thereon a 
program product , the program being executable bv a p ror^or to perform a ms&Qd for 
classifying a message, the computer program product being cmbodipd in a computer readable 
medium and comprising computer instructions for the method comprising; 

extracting a plurality of reference points from a body of the messag e; 
classifying the plurality of reference points; and 

detecting tha t determining Wither the message is a ffesh fraudulent message 

appear ing to be from a legitimate source based on the classified reference point s; and 

processing the message based on the determin ation of whether the message is a p hwh 
fraudulent message appearing to be from a leg itimate snnT ff . 

27. (cancelled) 

28. (currently amended) A computer readable storage medium having em bodied thpr^n a 
program pfed^et , th* program being executable bv a processor to perform a mefW fo r 
classifying a message, the computer program p^^^^^p ^rnbnd i rrl in n c o mp u ter re adable 
medium and comprising computer instruction for the method comp rising. 

identifying a plurality of fraud indicators in the message; 
applying a statistical analysis on the plurality of fraud indicators; «4 
determining whether the message is a fraudulent message based on the analysi s; and 
pressing fefi messa ge based on the d e termination of whether th* messag e ff 
fraudulent messag e. 
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